What are the consequences of the Brexit for Dutch organizations under the General Data Protection Regulation (GDPR)?
Data export ban
The consequences under the GDPR are mainly related to the transfer of personal data to the United Kingdom, including the storage of personal data there. For example if British suppliers are used, or information is exchanged with a British group company. This is also called ‘data export’.
This is relevant because the GDPR has as a starting point a prohibition on transferring personal data from the European Economic Area (EEA) to countries outside, if there is not a good level of privacy protection there.
“The EEA currently consists of EU countries , Norway, Iceland and Liechtenstein.”
If the UK became part of the EEA after the Brexit, there is no problem. Personal data may then simply be transferred to the UK. But at the moment it seems that this will not happen so the question is what the alternatives are.
Exceptions to data export prohibition
The GDPR contains the necessary exceptions to the data export ban.
Adequate protection level in UK
An exception that would make it easy to transfer personal data to the UK is if the European Commission determined that there was an adequate level of privacy protection in the UK. The Commission would then issue an ‘adequacy decision’.
This is the most practical alternative to a ‘non-EEA’ Brexit. There is a chance that the European Commission will determine this. The UK has already indicated that it will apply GDPR(AVG) and want to get an adequacy decision. But at the moment it is still pending.
Model contracts European Commission
If the European Commission does not determine this, then it must be examined whether there are other exceptions. One of those exceptions is the use of a so-called Model Contract from the European Commission . With such a contract, a controller within the EEA can share the personal data with a controller or processor outside the EEA.
More information about the exceptions for data export? https://www.smithanddoe.com/factsheet-dataexport-3
